… This could instead be generated within a hardware token; OpenSSL and several similar tools include support for that. openssl genpkey -algorithm Ed25519 -out oncall.key openssl req -new -key oncall.key -out oncall.csr \ -subj "/CN=user/O=oncall-payments" Create a CertificateSigningRequest with a sho… …
… With this enhancement, the kube-apiserver can delegate token signing to external systems such as cloud key management services or hardware security modules. This improves security and simplifies key management services for clusters that rely on centralized signing infrastructure. …
… This is especially useful for clusters that already rely on external identity or key management systems, allowing Kubernetes to integrate without duplicating key management inside the control plane. …
… Additionally, the imagePullCredentialsVerificationPolicy flag allows operators to configure the desired security level, ranging from a mode that prioritizes backward compatibility to a strict enforcement mode that offers maximum security. …